Field device for determining or monitoring a process variable in automation technology

ABSTRACT

A field device for determining or monitoring a process variable in automation technology. The field device meets a safety standard, which is required in a predetermined safety-critical application, comprising: a sensor, which works according to a defined measuring principle; and a control/evaluation unit, which processes and evaluates measurement data delivered by the sensor along at least three redundant and/or diversely designed measurement channels, wherein a redundant analog electrical current interface is provided, via which an electrical current representing the process variable is settable in a two-wire line. The analog electrical current interface is designed triply redundantly wherein the following components are associated with the analog electrical current interface: three electrical current setting channels connected in parallel, a doubly redundant voter, which detects a malfunction in one of the measurement channels and/or the electrical current setting channels a doubly redundant turn off stage, via which a measurement channel, respectively an electrical current setting channel, is turned off, when the voter detects a malfunction in the measurement channel or in the electrical current setting channel.

TECHNICAL FIELD

The invention relates to a field device for determining or monitoring aprocess variable in automation technology. The field device is soembodied that it meets a safety standard required in a predeterminedsafety-critical application. Furthermore, the field device includes asensor, which works according to a defined measuring principle, and acontrol/evaluation unit, which processes and evaluates measurement datadelivered by the sensor along at least three redundant and/or diverselydesigned measurement channels.

BACKGROUND DISCUSSION

A corresponding solution is known from published internationalapplication, WO 2004/013585 A1. Applied in automation technology,especially in process automation-technology, are field devices, whichserve for determining and monitoring process variables. Examples of suchfield devices are fill level measuring devices, flow measuring devices,analytical measuring devices, pressure and temperature measuringdevices, moisture and conductivity measuring devices, density andviscosity measuring devices. The sensors of these field devices registerthe corresponding process variables, e.g. fill level, flow, pH-value,substance concentration, pressure, temperature, moisture, conductivity,density and viscosity.

The terminology ‘field devices’ includes in connection with theinvention, however, also actuators, e.g. valves or pumps, via which, forexample, the flow of liquid in a pipeline or the fill level in acontainer is changeable. A large number of such field devices aremanufactured and sold by members of the firm, Endress+Hauser.

As a rule, field devices in modern automation technology plants areconnected via communication networks, such as HART-multidrop, point topoint connection, Profibus, Foundation Fieldbus, with a superordinatedunit, for instance a control system or control room. This superordinatedunit serves for process control, for process visualizing, for processmonitoring as well as for start-up and for servicing the field devices.For the operation of fieldbus systems, necessary supplementalcomponents, which are connected directly to a fieldbus and which serveespecially for communication with the superordinated units, are likewisefrequently referred to as field devices. These supplemental componentsinclude e.g. remote I/Os, gateways, linking devices, controllers orwireless adapters.

Depending on application, the field devices must satisfy the most variedof safety requirements. In order to meet the respective safetyrequirements, e.g. the IEC61508 safety integrity level (SIL standard),the field devices must be redundantly and/or diversely designed.

Redundancy means increased safety through doubled or multiple design ofall safety relevant, hardware and software components. Diversity meansthat the hardware components located in the different measurementchannels, such as e.g. a microprocessor, be from different manufacturersand/or be of different type. In the case of software components,diversity requires that the software stored in the microprocessorsoriginate from different sources, e.g from different manufacturers,respectively programmers. Via all these measures, it should be assuredthat a safety critical failure of the field device as well as theoccurrence of simultaneously arising systematic failures in theproviding of measured values be excluded with high probability.

An example of a safety-relevant application is fill level-monitoring ina tank, in which a flammable or even a nonflammable butwater-endangering liquid is stored. In such case, it must be assuredthat the supply of liquid to the tank is immediately interrupted, assoon as a maximum permitted fill level is achieved. This, in turn,assumes that the measuring device highly reliably detects fill level andworks faultlessly.

While in the case of known solutions the measurement channel isredundantly and/or diversely designed, nevertheless, the voter, usuallya microprocessor, represents the Achilles' heel of a field device, whichshould satisfy high and highest safety requirements. The microprocessoris monolithically embodied. If there is here a dangerous failure(corresponding to the nomenclature of the above mentioned standard),then the field device fails. In order to fulfill the requirements of SIL3, the fraction of dangerous failures to the total of all possiblefailures must lie at a maximum of one percent. With a conventionalmicroprocessor, this safety level cannot be achieved.

In order to solve this problem, in the non-prepublished Germanapplication, DE 10 2012 106 652.3, filed on Jul. 23, 2012, a fielddevice is described, whose voter is embodied as a majority voter andincludes three stages:

-   -   a comparator stage, which compares the output signals delivered        by the individual measurement channels with one another;    -   a failure recognition stage, which detects by suitable combining        of the output signals of the comparator stage a failure        occurring in a measurement channel, and    -   an output selection stage.

The content of the German application, DE 10 2012 106 652.3 isincorporated here by reference, especially as regards the voter.

Still, no field device is known, which fulfills the high safety levelalso in the region of the electrical current output module e.g. in thecase of a 4-20 mA two or four wire, field device.

SUMMARY OF THE INVENTION

An object of the invention is to provide a field device, which isdistinguished by increased functional safety.

The object is achieved by a field device for determining or monitoring aprocess variable in automation technology, wherein the field devicemeets a safety standard, which is required in a predeterminedsafety-critical application, comprising: a sensor, which works accordingto a defined measuring principle; and a control/evaluation unit, whichprocesses and evaluates measurement data delivered by the sensor alongat least three redundant and/or diversely designed measurement channels,and

wherein a redundant analog electrical current interface is provided, viawhich an electrical current representing the process variable issettable in a two-wire line, wherein the analog electrical currentinterface is designed triply redundantly and wherein the followingcomponents are associated with the analog electrical current interface:

-   -   three electrical current setting channels connected in parallel,    -   a doubly redundant voter, which detects a malfunction in one of        the measurement channels MK and/or the electrical current        setting channels,    -   a doubly redundant turn off stage, via which a measurement        channel, respectively an electrical current setting channel, is        turned off, when the voter detects a malfunction in the        measurement channel or in the electrical current setting        channel.

In a preferred embodiment of the field device of the invention, eachelectrical current setting channel includes an electrical currentsetting unit and an electrical current controller, wherein theelectrical current setting unit and the electrical current controllerare connected in parallel.

Furthermore, it is provided that the voter is composed of a plurality ofcomponents, which are at least partially or completely doublyredundantly designed.

Especially, it is provided that the voter is a majority voter, which hasa plurality of voter channels, wherein each voter channel containscomponents as follows: A comparator stage, via which output signalsdelivered by the individual electrical current setting channels arecompared with one another; a failure detection stage, which by suitablecombining of the output signals of the comparator stages associated withthe voter channels detects a malfunction occurring in a measurementchannel or in an electrical current setting channel; and a turn offstage, which turns off the electrical current setting channel, in whichthe failure detection stage detects a malfunction.

An advantageous further development of the field device of the inventionprovides that each voter channel includes a part of the comparatorstage, a part of the failure detection stage and a part of the turn offstage, and that each voter channel is embodied as an integratedcomponent of the associated measurement channel and of the associatedelectrical current setting channel.

Moreover, it is provided that the comparator stage for each voterchannel has two comparator modules, which compare the output signals ofthe associated electrical current setting channel with the outputsignals of the remaining electrical current setting channels.

Preferably, each of the failure detection stages is a logic stage, whichis constructed of two NAND gates, wherein applied to the inputs of thefirst NAND gate are the output signals of the comparators of a firstvoter channel, which is associated with a selected measurement channel,and wherein applied to the second NAND gate are the output signals ofthe comparators of the second voter channel and the third voter channelredundant to the inputs of the first NAND gate, and wherein the outputsignals of the first NAND gate and the second NAND gate form the controlsignals for the downstream turn off stage.

Preferably, each measurement channel, respectively each electricalcurrent setting channel, has its own voltage supply. This embodiment hasthe advantage that it in the case of loss of one of the voltage suppliesthere is no total failure of the field device.

Especially advantageous is when an alarm electrical current module isprovided, which is so embodied that it sets a failure current, e.g. of22 mA, when in at least two measurement channels, respectively in twoelectrical current setting channels, malfunctions occur simultaneously.In this way, it is prevented that the electrical current interface isunstable.

Furthermore, it is provided that the control/evaluation unit withmeasurement channels, respectively electrical current setting channels,and the associated components of the voter, respectively the voterchannels, is at least partially embodied in the measurement channels,respectively in the electrical current setting channels, as areconfigurable logic chip with a number of partially dynamicallyreconfigurable function modules.

Moreover, a reconfiguration control is provided, which so configuresfunction modules in the measurement channels or the electrical currentsetting channels as a function of the respectively defined,safety-critical application that the field device meets the requiredsafety standard.

Especially, there is associated with the reconfiguration control atleast one microprocessor, which partially dynamically reconfigures thefunction modules of a measurement channel or an electrical currentsetting channel, in which a failure is detected.

It is further provided in connection with the invention that at leastone of the measurement channels and/or the electrical current settingchannels is configured analog-based in an FPAA.

It is supplementally provided that the individual measurement channelsor electrical current setting channels are so spaced from one anotherthat a temperature- and/or a stress or voltage change in a measurementchannel or electrical current setting channel has no influence on aneighboring measurement channel or electrical current setting channel.

Preferably, the at least one microprocessor is permanently configured ina static region of the logic chip.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will now be explained in greater detail based on theappended drawing, the figures of which show as follows:

FIG. 1 is a block diagram of an electrical current output module knownfrom the state of the art;

FIG. 2 is a schematic representation of a form of embodiment of thefield device of the invention with sensor, triply redundant measurementchannels, triply redundant electrical current setting channels, doublyredundant voter channels and doubly redundant turn off stages;

FIG. 3 is a preferred embodiment of a redundant electrical currentinterface with redundant voter applicable in the case of the fielddevice of the invention;

FIG. 4 is an enlarged view of the electrical current interface of theinvention of FIG. 3;

FIG. 5 is an enlarged view of the electrical current interface of theinvention with the associated turn off stages for the electrical currentsetting channels of FIG. 3;

FIG. 6 is an enlarged view of the doubly redundant, safe voter withcomparator stages, failure detection stages and turn off stages of FIG.3; and

FIG. 7 is an enlarged view of the doubly redundant, safe voter withfailure detection stages, turn off stages and an alarm electricalcurrent module of FIG. 3.

DETAILED DISCUSSION IN CONJUNCTION WITH THE DRAWINGS

FIG. 1 shows a block diagram of an analog, electrical current, outputmodule 1 known from the state of the art. The electrical current outputmodule 1 impresses an electrical current I on an electrical current loop2, respectively a two-wire line. Via the electrical current loop 2, thefield device, respectively, here, the measuring device, composed ofsensor S and a control/evaluation unit 6, is connected with a remotelyarranged evaluation/output unit. Field devices, respectively, here,measuring devices, for determining or monitoring a process variable inautomation technology register the process variable and send theregistered measured values via the electrical current loop 2 or via adigital communication to a receiving unit, e.g. the already mentionedevaluation/output unit.

The electrical current I flowing in the electrical current loop 2 is soset via an electrical current controller 5 and an electrical currentsetting unit 7 that the set electrical current I represents theascertained process- or manipulated variable uniquely and with highaccuracy. Usually the 4-20 mA standard is used in automation technology.In such case, an electrical current of 4 mA in the electrical currentloop represents e.g. the minimum value of the process variable and anelectrical current of 20 mA e.g. the maximum value of the processvariable. The 4-20 mA technology is largely disturbance resistant, isapplicable in the explosion-endangered areas and is frequently used inindustrial applications.

Established in automation technology is so-called two conductortechnology, in the case of which the electrical current loop 2 transmitsnot only the measured or actuating values but also supplies thesensor/actuator with energy. Thus, only a limited power is available tothe field device for the measuring/control task. This power depends onthe supply voltage and the electrical current representing the currentmeasured value/actuating value. In order to assure a continuedavailability of the field device, conventional field devices are sodesigned that they manage with the minimally available power, i.e. theyrequire for measurement- or control operation only the power present atminimum electrical current and minimum voltage. If more power isavailable, this additional power is usually converted in an electricalcurrent sink 4 into power loss.

The electrical current output module 1 shown in FIG. 1 is implemented,for example, in a 4-20 mA transmitter, thus in the electronics part, ofa field device. The electrical current output module 1 supplies theelectrical current I, which flows through the electrical current loop 2.The electrical current I is represented by the voltage source V1 and theresistor R1—to the left of the positive connection 3 a and the negativeconnection 3 b. The voltage source V5 represents the desired value ofthe electrical current loop control 5.

The transistor Q2 of the electrical current setting unit 7 controls theelectrical current, which flows from the positive connection 3 a to theelectrical current sink 4. The electrical current sink 4 lies atreference potential, preferably at ground GND. The electrical currentflows to the negative connection 3 b via the measuring resistor R12. Inthis way, a voltage is produced between the negative connection andground GND, which is proportional to the flowing electrical current.This voltage is used as reference voltage for controlling the transistorQ2 and, thus, for setting the electrical current in the electricalcurrent loop 2. The control of the set electrical current occurs via theelectrical current loop control 5. Centerpiece of the electrical currentloop control 5 is the operational amplifier U2A. The operationalamplifier U2A controls the transistor Q1 and also the transistor Q2 insuch a manner that at the plus output of the operational amplifier U2Athe sum of the voltages equals zero. If this condition is fulfilled,then the electrical current I through the measuring resistor R12 and inthe electrical current loop 2 is proportional to the desired value,which is represented by the voltage V5.

If the energy supply of the field device occurs via the same electricalcurrent loop 2, which is also used for supplying the measured oractuating values of the field device, then the electrical current sink 4serves to drain the electrical current not required by the field deviceto ground GND and, thus, to convert it into power loss. If the energysupply of the field device occurs via a separate electrical currentline, then the electrical current sink 4 can be omitted, respectively itcan be replaced by a short circuit.

FIG. 2 shows a schematic representation of the field device of theinvention with a sensor S, triply redundant measurement channels MK1,MK2, Mk3, triply redundant electrical current setting channels IK1, IK2,IK3 and triply redundant voter channels VK1, VK2, VK3. The voter Vcomprises the voter channels VK1, VK2, VK3, wherein associated with thevoter channels VK1, VK2, VK3 are at least parts of the comparator stages11.1, 11.2, 11.3, the failure detection stages 10.1, 10.2, 10.3 and theturn off stages 9.1, 9.2, 9.3. The redundant analog electrical currentinterface 8 includes the electrical current setting channels IK1, IK2,IK3 and the voter channels VK1, VK2, VK3.

FIG. 3 shows a preferred embodiment of a redundant electrical currentinterface 8 with safe redundant voter V applicable in the case of thefield device of the invention. The field device of the invention andespecially the analog electrical current interface 8 are so embodiedthat they satisfy the high safety requirements in a desiredsafety-critical application, e.g. SIL 3. The voltage V1 and the resistorR1 represent the voltage supply, via which the 4-20 mA electricalcurrent loop 2 is supplied with energy. For example, the voltage supplyis integrated in a remotely arranged output/evaluation unit, e.g. a PLC.

Not concretely shown in FIG. 3 is the control/evaluation unit 6, whichprocesses and evaluates the output signals V5, V8, V4 delivered by thesensor S (in the case of a sensor S, the output signals V5, V8, V4represent, especially, measured values) along at least three redundantand/or diversely designed measurement channels MK1, MK2, MK3. Theessential components of the electrical current interface 8 of theinvention shown in FIG. 3 are shown and described in detail in thefollowing figures FIGS. 4-7.

The embodiment shown in FIG. 3 for the redundant electrical currentinterface 8 of the invention, via which an electrical current Irepresenting the process variable is set on the electrical current loop2, includes components as follows:

-   -   three electrical current setting channels IK1, IK2, IK3        connected in parallel (see FIG. 4);    -   a doubly redundant voter V, which detects a malfunction in one        of the measurement channels MK1, MK2, MK3 and/or one of the        electrical current setting channels IK1, IK2, IK3 (see FIG. 6);    -   a triply redundant turn off stage 9.1, 9.2, 9.3, via which an        electrical current setting channel IK1, IK2, IK3 is turned off,        when the voter V detects a malfunction Fch1, Fch2, Fch3 in the        measurement channel MK1, MK2, MK3 or in the associated        electrical current setting channel IK1, IK2, IK3 (see FIG. 5);    -   an alarm electrical current module 14, which sets an alarm        electrical current, when a malfunction Fch occurs simultaneously        in at least two measurement channels MK1, MK2, MK3 and/or        electrical current setting channels IK1, IK2, IK3 (see FIG. 7).

The analog, redundantly designed, electrical current interface 8 isshown and described in FIG. 4 in detail in enlarged view. The setting ofthe electrical current I occurs via the parallel transistors Q2, Q4, Q7associated with the electrical current setting units 7.1, 7.2, 7.3. Thedesired values for the turning-on of the transistors Q2, Q4, Q7 by thethree parallel electrical current loop controls 5.1, 5.2, 5.3 correspondto the output signals V5, V8, V4 of the three measurement channels MK1,MK2, MK3 (not detailed in FIG. 4). Via the transistors Q2, Q4, Q7, theelectrical current is controlled, which is converted in the electricalcurrent sink 4 into power loss.

In the illustrated case, each of the operational amplifiers U2A, U3A,U4A of the electrical current loop controls 5.1, 5.2, 5.3 has its ownvoltage supply VCC1, VCC2, VCC3. This embodiment has the advantage that,in the case of loss of one of the voltage supplies, no total failure ofthe field device occurs.

The shading in FIG. 4 indicates the associating of the individualcomponents of the analog electrical current interface 8 to the threeelectrical current setting channels IK1, IK2, IK3. The shading ismaintained in the subsequent figures and in FIG. 3. The shading alsoindicates the different channels, wherein each channel preferably hasits own voltage supply. Components, which are not redundantly designed,include the resistor R12 and the diode U1, which assures that electricalcurrent can only flow in the desired direction. In the illustrated case,there is likewise only one electrical current sink 4; however, theelectrical current sink 4 can, same as the other components of theanalog electrical current interface 8, also be triply redundantlydesigned, wherein the current sinks 4 are then connected in parallel.This increases safety also in this part of the circuit.

In the case of the circuit shown in FIG. 4, the output current I, whichflows in the electrical current loop 2, is automatically predeterminedvia the electrical current setting channel IK, in which the greatestelectrical current is set. The circuit is, so-to-say, so designed thatthe electrical current setting channel IK with the greatest setelectrical current wins. The field device of the invention has, as awhole, the accuracy of the measurement channel MK, which processes andevaluates the measured values/actuating values with the least accuracy.Usually, this measurement channel is the analog measurement channel MK.If there is a malfunction in one of the measurement channels MK or inone of the electrical current setting channels IK, then thecorresponding electrical current setting channel IK sets an incorrectelectrical current. If this incorrect electrical current is higher thanthe electrical current set in the two correctly set electrical currentsetting channels IK, then the incorrect electrical current is set in theelectrical current loop 2 and the field device delivers an incorrectmeasured value. As a result of the incorrectly set electrical currentvalue, an incorrect measured value/actuating value is transmitted on theelectrical current loop. In order to assure the desired high safetyrating even in the case of occurrence of a malfunction Fch, a turn offstage 9.1, 9.2, 9.3 is associated with each electrical current settingchannel IK1, IK2, IK3, respectively each electrical current setting unit7.1, 7.2, 7.3.

The turn off stages 9.1, 9.2, 9.3 are shown in FIG. 5 supplementally tothe electrical current controllers 5.1, 5.2, 5.3 and the electricalcurrent setting units 7.1, 7.2, 7.3. The turn off stages 9.1, 9.2, 9.3are controlled from the voter V by the signals A, B, C, D, E, F. As soonas the voter V detects a malfunction Fch in a measurement channel MK1,MK2, MK3 or in an electrical current setting channel IK1, IK2, IK3 (thisis the case, when the corresponding measured- or electrical currentsetting channel MK, IK produces an output signal, which deviates fromthe output signals of the two remaining measurement channels MK orelectrical current setting channels IK), then the voter V brings aboutvia the output signals A, B, C, D, E, F the turning off of the defectiveelectrical current setting channel IK. The turn off stages 9.1, 9.2, 9.3are doubly redundantly embodied in each of the measuring/electricalcurrent setting channel MK, IK, since the voter V is doubly redundantlyembodied in each of the measuring/electrical current setting channelsMK, IK.

Preferably, each turn off stage 9.1, 9.2, 9.3 is composed from simpletransistors Q9, Q10; Q12, Q13; Q14, Q15, which interrupt the controlsignal, and, thus, the base current, of the transistors Q2, Q4, Q7responsible for the electrical current control. As soon as the basecurrent is interrupted, the transistor Q2, Q4, Q7 becomes open, and noelectrical current flows in the electrical current loop 2. The tworemaining electrical current setting channels IK undertake, then,seamlessly, the function of setting the electrical current on theelectrical current loop 2; the setting of the electrical current on theelectrical current loop 2 occurs automatically via one of the remainingelectrical current setting channels IK.

The assumption of the setting function by one of the remainingelectrical current setting channels IK can be utilized in the followingway: As evident from FIG. 5, especially, however, from FIG. 6, twotransistors Q14, Q15; Q12, Q13; Q9, Q10 are arranged in each turn offstage 9.1, 9.2, 9.3. In this way, it is possible for the voter V to turnoff the electrical current setting channels IK1, IK2, IK3 independentlyof one another. The output signals of the electrical current settingchannels Ch1, Ch2, Ch3 must be made available to the voter V. In orderto assure that also in the case of the analog components of theelectrical current setting module 1 a failure detection occurs, theoutputs of the electrical current controller units 5.1, 5.2, 5.3 must bemade available to the voter V. Since it is not possible directly tomeasure the electrical currents at the transistors Q2, Q4, Q7, theoutput signals of the operational amplifiers U2A, U3A, U4A are used. Thecorresponding output signals are labeled in FIGS. 5 and 6 with Ch1, Ch2,Ch3.

As already mentioned above, it is with the solution of the inventionpossible to assure the correct operation of the field device even when ameasurement- or electrical current setting channel MK, IK is lost. Assoon as an electrical current value deviating from the desired value isdetected in one of the measurement- or electrical current settingchannels MK, IK and, thus, a malfunction Fch has occurred, themalfunctioning measurement- or electrical current setting channel MK, IKis switched off. Its function is automatically assumed by one of theremaining measurement- or electrical current setting channels MK, IK.

In order to detect the malfunction, a voter channel VK1, VK2, VK3 isassociated with each electrical current setting channel IK1, IK2, IK3.Each voter channel VK1, VK2, VK3 is part of the doubly redundant voter Vand is composed of a comparator stage 11.1, 11.2, 11.3 and a failuredetection stage 10.1, 10.2, 10.3. Each comparator stage 11 includes twocomparator modules 12, which, in turn, have two comparators 18 and twovoltage dividers 16. Since the signals, which are fed to the comparators18, are analog signals, the comparators 18 must be analog components.This has the advantage that a malfunction Fch is detected directly afterits occurrence and the switching on of one of the remaining electricalcurrent setting channels IK can likewise occur without time delay. Inthis way, a seamless transition and therewith a continuous operation ofthe field device are assured.

Each comparator module 12 is composed, such as already stated, of twoanalog comparators 18 and two voltage dividers 16. The tolerance in thecase of comparison of the accuracies of the channels correspondsessentially to the accuracy of the measurement channel MK with the leastaccuracy. Preferably, the tolerance lies at one percent of the currentmeasured value. The measurement channel MK with the least accuracy is,in principle, the analog measurement channel MK. The output of acomparator stage 11 signals the difference between two signals, whichdifference is greater than 1%.

As a formula, this can be expressed as follows:(CH3≠CH1) is true, when (CH3>Ch1×0.99)Λ(Ch1>Ch3×0.99), wherein thetolerance amounts to 1.01%/−1%.

Moreover, for correct calculation, also the tolerances of thecomparators 12 and the resistors of the voltage divider 16 must be takeninto consideration. Assuming that the components have an ideal behaviorand, thus, no deviations, the factor 0.99 is applied to the sizes of theresistors of the voltage divider 16. For example, R40 amounts to 470 kΩand R41 to 4.7 kΩ.

The comparator stages 11 are connected with the failure detection stages10, which detect, in which of the measurement- or electrical currentsetting channels MK, IK a malfunction has occurred. If, for example,(Ch1≠Ch2)Λ(Ch1≠Ch3), then a malfunction has occurred in channel IK1. Thefailure detection stage 10.1 controls the corresponding turn off stage9.1 in such a manner that the electrical current controller unit 7.1 ofthe channel IK1, in which the malfunction is present, is turned off.

As is evident from FIGS. 6 and 7, the voter V is doubly redundant. VoterV permits reliable detection of a malfunction Fch occurring in one ofthe electrical current setting channels IK, even in the case that themalfunction Fch occurs in a component of the voter V, thus either in thecomparator stage 11, the failure detection stage 10 or in the turn offstage 9 of any electrical current setting channel IK. In case somecomponent in one of the electrical current setting channels IK is lost,then the setting function is assumed by one of the remaining electricalcurrent setting channels IK—the ability of field device to function is,thus, assured even in the case of occurrence of a malfunction in one ofthe electrical current setting channels IK. Of course, according to theinvention, also failures are recognized, which occur in the upstreamconnected measurement channels MK.

The analogy embodied, doubly redundant voter V is so embodied that italso continues to work in the case of failure of the voltage supply in achannel IK. Thus, the field device remains operationally ready. If avoltage supply fails, then the electrical current controller5/electrical current setting unit 7 of the affected channel IK is lost.The function of the affected channel IK is assumed by one of theremaining channels IK. Since the failure detection stage 10 of a channelIK obtains information from the comparators 12 of the other channels IK,it is important that a channel IK in the case of elimination of thevoltage does not influence the other channels IK. Therefore, the failuredetection stage 10 is provided with pull-down resistors 13. Each pulldown resistor 13 is connected between a signal line and ground potentialand assures that the signal is set to a defined level, when anelectrical current setting channel IK is switched off and the controlunit is lost due to the turning off of an electrical current settingchannel IK. So long as the control unit correctly works, the pull downresistances 13 have no influence on the signal, since they arerelatively high resistance. The pull down resistances 13 assure that acorrectly working electrical current setting channel IK is not switchedoff when the voltage supply in one of the other electrical currentsetting channels IK is lost. Moreover, there are provided in each of theelectrical current setting channels IK voltage monitoring elements,which detect over- or under voltages. A voltage monitoring element canin the case of occurrence of a malfunction turn off the energy supply ofthe affected electrical current setting channel IK.

Details of FIG. 6 will now be explained. Each voter channel VK includesa part of the comparator stage 11, a part of the failure detection stage10 and a part of the turn off stage 9. Each voter channel VK is embodiedas an integrated component of the associated measurement channel MK andthe associated electrical current setting channel IK.

With reference to the voter channel VK1, the comparator stage 11.1includes two comparator modules 12, which compare the output signals Ch1of the associated electrical current setting channel IK1 with the outputsignals Ch2, Ch3 of the remaining electrical current setting channelsIK2, IK3. The output signals of the two comparators 18 of each of thecomparator modules 12 form the input signals for the downstream NANDgate 22.1 and the downstream NAND gate 22.2. The output signals F, E ofthe NAND gate 22.1 and the NAND gate 22.2 are the supplied to thefailure detection stage 10.1.

In the failure detection stage 10.1 downstream from the comparator stage11.1, it is ascertained, in which of the measurement- or electricalcurrent setting channels MK, IK a malfunction has occurred. The failuredetection stages 10.1, 10.2, 10.3 are logic stages composed of two NANDgates 15.1, 15.2. Let us consider in the following the first voterchannel VK1 somewhat more exactly: On the inputs of the first NAND gate15.2 lie the output signals E, F of the comparator stage 11.1 of thefirst voter channel VK1. The first voter channel VK1 is associated withthe first measurement channel MK1. On the inputs of the second NAND gate15.1 lie the redundant output signals B, D of the comparator stages11.2, 11.3 of the second voter channel VK2 and of the third voterchannel VK3. The output signals of the first NAND gate 15.2 and thesecond NAND gate 15.1 form the control signals for the downstream turnoff stage 9.1. So long as at least one input signal of the first NANDgate 15.2 and at least one input signal of the second NAND gate 15.1 areat the logic “0” state, nothing happens. As soon as the two inputsignals of the first NAND gate 15.2 or the two input signals of thesecond NAND gate 15.1 are at the logic “1” state, the correspondingelectrical current setting channel IK1 is immediately turned off by thecorresponding turn off stage 9.1. Analogous considerations hold for thetwo additional electrical current setting channels VK2, VK3.

If the control/evaluation unit 6 is embodied as a dynamicallyreconfigurable or a reconfigurable or simple only as an FPGA and twochannels MK, IK are implemented in the FPGA, then the two channels MK,IK are connected to one voltage supply. Therefore, the electricalcurrent supply of an individual channel MK, IK cannot be turned off.

FIG. 7 shows the alarm electrical current module 14 together with thefailure detection stages 10.1, 10.2, 10.3 and the turn off stages 9.1,9.2, 9.3. The alarm electrical current module 14 is so embodied that itcan detect multiply occurring malfunctions Fch in different measurementchannels MK or electrical current setting channels IK. In principle, thealarm electrical current module 14 is a fourth electrical currentsetting channel IK4, which can be so triggered that it sets a failurecurrent of ≥22 mA, the so-called alarm electrical current. Thetriggering occurs via the driver 20 for the alarm electrical currentcontrol 19. Since this alarm electrical current in a 4-20 mA electricalcurrent loop is greater than all other electrical currents flowing inthe analog electrical current interface 8, the control is automatic. Thealarm electrical current module 14 is preferably fed from its ownvoltage supply VCC4.

The alarm electrical current module 14 is controlled according to analgorithm, which is brought together in the following formulas andimplemented in FIG. 7 by a logic stage. An alarm electrical current isset, when a malfunction occurs in at least two channels simultaneously.In such case, FchX·Y=1 stands for a failure in the measuring/electricalcurrent setting channel X detected by the failure detection stage Y. Thealgorithm is expressed as a formula as follows:((Fch1.1

Fch1.2)

((Fch2.1

Fch2.2))

((Fch1.1

Fch1.2)

((Fch3.1

Fch3.2))

((Fch2.1

Fch2.2)

((Fch3.1

Fch3.2))

The alarm electrical current module 14, thus, detects at least twosimultaneously occurring failures, which occur in two differentmeasurement channels MK and/or electrical current setting channels IK.The alarm electrical current module 14 can also be triggered by othermodules, such as, for example, by a voltage monitoring unit or byreconfiguration controls. These embodiments are not shown in FIG. 7. Thesignals of the failure detection stages 10 are preferably forwarded tothe reconfiguration control, which initiates reconfiguration ofdefective measurement channels MK. This is shown and described in theabove mentioned DE 10 2012 106 652.3 in its FIGS. 1, 2 and 3.

Essential differences with reference to the present invention are thatthe voter V in the case of the present invention is implemented in theanalog electrical current interface 8 and that the electrical currentinterface 8 is redundant.

The invention claimed is:
 1. A field device for determining ormonitoring a process variable in automation technology, wherein thefield device meets a safety standard, which is required in apredetermined safety-critical application, comprising: a sensor, whichworks according to a defined measuring principle; a control/evaluationunit, which processes and evaluates measurement data delivered by saidsensor along at least three redundant and/or diversely designedmeasurement channels; and a redundant analog electrical currentinterface, via which an electrical current representing the processvariable is settable in a two-wire line, wherein: said redundant analogelectrical current interface is designed triply redundantly; and thefollowing components are associated with said redundant analogelectrical current interface: three electrical current setting channelsconnected in parallel; a doubly redundant voter, which detects amalfunction in one of said measurement channels and/or said electricalcurrent setting channels; and a doubly redundant turn off stage, viawhich one of said measurement channels, respectively one of saidelectrical current setting channels, is turned off, when said doublyredundant voter detects a malfunction in said one of said measurementchannels or in one of said electrical current setting channels.
 2. Thefield device as claimed in claim 1, wherein: each electrical currentsetting channel includes an electrical current setting unit and anelectrical current controller; and said electrical current setting unitand said electrical current controller in each electrical currentsetting channel is connected in parallel.
 3. The field device as claimedin claim 1, wherein: said voter is composed of a plurality ofcomponents, which are at least partially or completely doublyredundantly designed.
 4. The field device as claimed in claim 1,wherein: said voter is a majority voter, which has a plurality of voterchannels, each voter channel contains components as follows: acomparator stage, via which output signals delivered by the individualelectrical current setting channels are compared with one another; afailure detection stage, which by suitable combining of the outputsignals of said comparator stages associated with said voter channelsdetects a malfunction occurring in a measurement channel or in anelectrical current setting channel; and a turn off stage, which turnsoff said electrical current setting channel, in which said failuredetection stage detects a malfunction.
 5. The Field device as claimed inclaim 1, wherein: each voter channel includes a part of said comparatorstage, a part of said failure detection stage and a part of said turnoff stage; and each voter channel is embodied as an integrated componentof the associated measurement channel and of the associated electricalcurrent setting channel.
 6. The field device as claimed in claim 1,wherein: said comparator stage for each voter channel has two comparatormodules, which compare the output signals of the associated electricalcurrent setting channel with the output signals of the remainingelectrical current setting channels.
 7. The field device as claimed inclaim 5, wherein: each of said failure detection stages is a logicstage, which is constructed of two NAND gates; applied to the inputs ofsaid first NAND gate are the output signals of said comparators of afirst voter channel, which is associated with a selected measurementchannel; applied to said second NAND gate are the output signals of saidcomparators of said second voter channel and of the third voter channelredundant to the inputs of said first NAND gate, and; the output signalsof said first NAND gate and said second NAND gate form the controlsignals for said turn off stage.
 8. The field device as claimed in claim1, wherein: each measurement channel/electrical current setting channelhas its own voltage supply.
 9. The field device as claimed in claim 1,further comprising: an alarm electrical current module, which is soembodied that it sets a failure current, when in at least twomeasurement channels, respectively in two electrical current settingchannels, malfunctions occur simultaneously.
 10. The field device asclaimed in claim 1, wherein: said control/evaluation unit withmeasurement channels/electrical current setting channels, and theassociated components of said voter, respectively said voter channels,is at least partially embodied as a reconfigurable logic chip with anumber of partially dynamically reconfigurable function modules in themeasurement channels electrical current setting channels.
 11. The fielddevice as claimed in claim 1, further comprising: a reconfigurationcontrol, which configures function modules in said measurement channelsor in said electrical current setting channels as a function of therespectively defined safety-critical application that the field devicemeets the required safety standard.
 12. The field device as claimed inclaim 11, wherein: there is associated with said reconfiguration controlat least one microprocessor, which partially dynamically reconfiguresthe function modules of a measurement channel or an electrical currentsetting channel, in which a failure is detected.
 13. The field device asclaimed in claim 1, wherein: at least one of said measurement channelsor electrical current setting channels is configured analog-based in anFPAA.
 14. The field device as claimed in claim 1, wherein: saidindividual measurement channels or electrical current setting channelsare so spaced from one another that a temperature- and/or a stress orvoltage change in a measurement channel or electrical current settingchannel have/has no influence on a neighboring measurement channel orelectrical current setting channel.
 15. The field device as claimed inclaim 1, wherein: said at least one microprocessor is permanentlyconfigured in a static region of the logic chip (FPGA).